Affected by GO-2026-5255
and 4 other vulnerabilities
GO-2026-5255: nebula-mesh: Decrypted CA private key persists in heap after signing in github.com/forgekeep/nebula-mesh
GO-2026-5950: nebula-mesh: Host revocation is not durable - blocked/offboarded hosts can regain a valid certificate in github.com/forgekeep/nebula-mesh
GO-2026-5984: nebula-mesh: CA private key not zeroized on web mobile-bundle error paths in github.com/forgekeep/nebula-mesh
GO-2026-5986: nebula-mesh: Certificate revocation is never enforced at the mesh in github.com/forgekeep/nebula-mesh
GO-2026-5991: nebula-mesh: Operator session tokens stored in plaintext in the database in github.com/forgekeep/nebula-mesh